Thanks for the explanation, but all the user issues observed by Mark and I involved scan engine 0.99.2.
-Al- On Mon, Nov 07, 2016 at 06:48 AM, Joel Esler (jesler) wrote: > > We split the daily into two, essentially, from what I understand. Then > changed the flevel on the second set. This will allow older versions of > ClamAV to receive updates, without crashing and newer versions of ClamAV to > handle everything. > > Maybe the speed of the connection or the mirror? > > Sent from my iPhone > >> On Nov 7, 2016, at 9:12 AM, Mark Allan <markjal...@gmail.com> wrote: >> >> Hi Joel, >> >> Thanks for the explanation. I'm still confused/surprised as to why such a >> large cdiff should cause freshclam to hang though. What is the file size >> limit that freshclam can handle safely? Also, given the cdiff file was >> approximately the same size as the entire daily db, would it have been >> better simply to skip that cdiff, causing everyone to re-download a new >> daily.cvd? Or is that not advisable for some reason? >> >> Thanks. >> Mark >> >>> On 7 Nov 2016, at 1:58 pm, Joel Esler (jesler) <jes...@cisco.com> wrote: >>> >>> Oh my, I apologize, it just dawned on me that I sent a note to the mirrors >>> list, but not to the users list. >>> >>> A "larger than normal" cdiff to the Daily.cvd was published. Unfortunately >>> with the timeline that we had to publish it, and my personal travel >>> schedule, I was not able to put out a note prior to it being published, but >>> I wanted to take a second to explain what happened. >>> >>> The failure condition symptom in ClamAV was the message "LibClamAV Error: >>> mpool_malloc(): Attempt to allocate 8388608<tel:8388608> bytes.", and was >>> documented as ClamAV bug 11647: >>> https://bugzilla.clamav.net/show_bug.cgi?id=11647. >>> >>> This affects ClamAV versions before 0.98. There is a maximum mpool size >>> limit that was reached based on the total signatures combined in memory of >>> ClamAV holding the main and daily CVD. >>> >>> Those versions of ClamAV are EOL, and we knew we wanted to continue to add >>> coverage for ClamAV users. We found a way to fit a smaller working >>> signature set within the memory limits for the unsupported older versions, >>> while still providing all signature content for supported and future >>> versions. Therefore many new signatures will be marked for ClamAV 0.98 and >>> forward (flevel increase) , and we have shifted a large number of >>> signatures to allow prior versions to load the smaller signature set. >>> >>> We still strongly recommend that ClamAV users update their software in >>> order to get full coverage from ClamAV. We cannot change the hard limits of >>> the old versions, but from the comments on the mailing list and Bugzilla >>> this should smooth the upgrade path. For any users running into issues >>> upgrading ClamAV, look on the ClamAV Bugzilla for details. Several other >>> tricky upgrade related questions have already been raised and settled in >>> the comment section. >>> >>> Bottom line is, if you are using a version of ClamAV prior to 0.98.0 (0.97, >>> 0.96, etc) you need to upgrade _now_. >>> >>> Please do not hesitate to ask me any questions concerning this. >>> >>> Sent from my iPad >>> >>> On Nov 7, 2016, at 6:52 AM, Mark Allan >>> <markjal...@gmail.com<mailto:markjal...@gmail.com>> wrote: >>> >>> Hi folks, >>> >>> Was "daily-22474.cdiff" supposed to be ~20MB in size? The freshclam binary >>> seems to hang whilst processing it, and if left long enough, you end up >>> with a corrupt daily.cld database. >>> >>> I'm surprised no-one else has reported this here, so I'm wondering was it >>> only the UK mirrors that were affected? Has anyone any idea what went wrong? >>> >>> Mark >> >> _______________________________________________ >> clamav-users mailing list >> clamav-users@lists.clamav.net >> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users >> >> >> Help us build a comprehensive ClamAV guide: >> https://github.com/vrtadmin/clamav-faq >> >> http://www.clamav.net/contact.html#ml > _______________________________________________ > clamav-users mailing list > clamav-users@lists.clamav.net > http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users > > > Help us build a comprehensive ClamAV guide: > https://github.com/vrtadmin/clamav-faq > > http://www.clamav.net/contact.html#ml -Al- -- Al Varnell Mountain View, CA
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ clamav-users mailing list clamav-users@lists.clamav.net http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
